Privacy regulations

In the Museum de Fundatie Foundation (hereinafter referred to as MdF), we process personal data of our contact persons. Personal data (in brief) is defined as any data that can be traced back to natural persons. This means that it can be data that is either directly about someone or can be traced back to a natural person.

Processing personal data is understood to mean (in short); any action relating to personal data. This may include the collection, recording, organisation, storage, updating, modification, retrieval, consultation, use, transmission, dissemination, making available, association, erasure and destruction of personal data. The processing of personal data is therefore unavoidable for the business operations of MdF.

This does not alter the fact that MdF considers the privacy of its contacts to be of great importance and, when processing personal data, observes the rights and obligations arising from the 2018 General Data Protection Regulation ("AVG"). With this privacy statement, MdF wishes to inform its contacts about how it handles personal data that are processed.

This privacy statement contains the following information:

1. What personal data are processed? 
2. What particular personal data are processed?  
3. For what purpose are the personal data processed? 
4. How long will personal data be kept? 
5. Who has access to the personal data?"
6. With whom will the personal data be shared?
7. How will personal data be secured? 
8. What are your rights?
9. Questions and complaints.

The personal data of contacts that are processed by MdF are:

• Name, first names, initials, call sign, title & gender.
• Address, postal code, city, telephone number and e-mail.
• Bank- en girorekeningnummer.
• Een administratienummer.
• Data necessary because of an agreed condition of employment.

MdF does not collect special categories of personal data.

Every processing operation involving personal data must have a lawful basis. Processing is lawful when MdF can base it on one of the six legal grounds set out in the GDPR. The legal grounds on which MdF bases its processing are:

• Processing is necessary in order to comply with a legal obligation.
• MdF has a legitimate interest in the processing, which, in short, overrides the interest of the person whose personal data are being processed.

The processing of data takes place for the following purposes:

• internal control and business security;
• collecting debts, including transferring those debts to third parties for collection;
• handling disputes;
• carrying out audits;
• implementing or applying a law.

Personal data will only be used for the purpose for which they were collected.

MdF will not store personal data for longer than necessary. The registration of personal data is kept to a minimum. The retention periods applied are:

• Fiscally relevant data are stored for seven years after the end of the employment contract.
• Other personal data are generally stored for two years after the end of the contact, unless the data are no longer needed earlier.

Personal data may and will only be provided to those, including third parties, who are responsible for carrying out the purposes mentioned above.

Others may have access if:

• the data processing is necessary for the controller to comply with a legal obligation;
• the data are further processed for historical, statistical or scientific purposes, provided that the data are anonymised and can no longer be traced back to individuals.

Personal data are not shared with anyone, unless sharing the data is necessary for the controller to comply with a legal obligation, or unless they are further processed for historical, statistical or scientific purposes. In the latter case, the data are anonymised and can no longer be traced back to individuals.

MdF has taken appropriate technical and organisational security measures to protect personal data against loss, misuse and unauthorised access by third parties. If, despite these security measures, a data breach occurs, it will be recorded and the data breach policy will be followed.

Under the GDPR, every natural person whose personal data are processed has certain rights. These rights are:

• Right of inspection; 
  Every contact person can ask to see the personal data processed about him or her; 
• Right to a copy.
  Every contact person has the right to request a copy of the existing contact data; 
• Right to rectification/completion. 
  Every contact person has the right to rectification/completion of his or her personal data, this in case data are factually incorrect or incomplete. Correction/completion of personal data will be made to the extent reasonable, given the purpose of processing the personal data. If a contact person does not agree with the processing of the personal data, he/she may add his/her own statement; 
• Right to delete.
  Every contact has the right to have data deleted when: 
  - data are processed unlawfully; 
  - a legal 'erasure obligation' applies; 
  - data are no longer needed, given the purposes for which they were processed; 
  - the contact person objects to the processing and MdF has no interests that outweigh the employee's interest; 
• Right to data portability.

For questions about the processing of your personal data, you can contact us via info@museumdefundatie.nl.

If you believe that MdF is not acting in accordance with this privacy statement or with applicable privacy legislation, you can contact us via info@museumdefundatie.nl.

If you are not satisfied with the way in which MdF handles your complaint or complaints, you can submit a complaint to the Dutch Data Protection Authority.